CVE-2020-12077: 
WordPress vulnerability analysis and mitigation

CVE-2020-12077 affects the MapPress Maps Pro WordPress plugin versions before 2.53.9. The vulnerability was discovered in April 2020 and allows for Remote Code Execution (RCE) due to incorrect access control in AJAX actions (Wordfence).

The vulnerability exists in the pro version of the plugin where several AJAX actions lack proper capability checks and nonce checks, specifically in the 'ajax_get', 'ajax_save', and 'ajax_delete' functions within mappress_template.php. The vulnerability has a CVSS score of 6.5 (Medium) with vector CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L (WPScan).

An attacker with minimal permissions (such as a subscriber) can upload executable PHP files including potential backdoors, delete existing PHP files on the site (such as wp-config.php), and view the contents of any existing PHP file on the site through directory traversal attacks (WPScan).

The vulnerability can be exploited by authenticated users with minimal permissions by sending specific POST requests to wp-admin/admin-ajax.php. This includes the ability to perform file operations through directory traversal and achieve remote code execution (WPScan).

Users should immediately update to MapPress Maps Pro version 2.53.9 or later which includes the security fix for this vulnerability (Wordfence).